Secure cloud processing

1. A method comprising:

generating, on a publicly accessible server, a secure enclave, the secure enclave having isolated memory and processing resources of the server;

installing, on the secure enclave, a virtual machine comprising a guest operating system of a first entity;

installing, by the virtual machine on the guest operating system, one or more cryptographic processes associated with the first entity; and

encrypting and decrypting cryptographic keys associated with the first entity using the one or more cryptographic processes.

2. The method of claim 1 , wherein the publicly accessible server is configured to execute multiple processes for a plurality of entities, wherein the isolated memory and processing resources of the server are exclusively reserved for processes associated with the first entity, and wherein the memory and processing resources are isolated from other memory and processing resources of the server that are used for executing the multiple processes for the plurality of entities.

3. The method of claim 1 , further comprising executing, by the virtual machine, one or more serverless functions.

4. The method of claim 3 , wherein the one or more serverless functions comprise Lambda functions.

5. The method of claim 1 , wherein the virtual machine runs a host operating system comprising the guest operating system, and wherein the host operating system runs an executable functional code block comprising the one or more cryptographic processes or serverless functions.

6. The method of claim 5 , further comprising:

establishing, by a client device, a communication session with the publicly accessible server via a TCP interface; and

receiving, from the client device through the communication session, a message directed to the host operating system via a public-key cryptography standard (PKCS) #11 interface, the message comprising a request to encrypt or decrypt data using the cryptographic keys.

7. The method of claim 6 , wherein the message is received from the client device via the Internet.

8. The method of claim 6 , further comprising:

generating, by the executable image file, one or more credentials in response to receiving the message; and

transmitting the one or more credentials to the client device via the PKCS #11 interface.

9. The method of claim 8 , wherein the client device is configured to obtain access to a secure resource protected by one or more physical or logical access devices based on the one or more credentials.

10. The method of claim 5 , wherein the one or more cryptographic processes are proprietary to the first entity.

11. A system comprising:

one or more processors configured to perform operations comprising:

generating, on a publicly accessible server, a secure enclave, the secure enclave having isolated memory and processing resources of the server;

installing, on the secure enclave, a virtual machine comprising a guest operating system of a first entity;

installing, by the virtual machine on the guest operating system, one or more cryptographic processes associated with the first entity; and

encrypting and decrypting cryptographic keys associated with the first entity using the one or more cryptographic processes.

12. The system of claim 11 , wherein the publicly accessible server is configured to execute multiple processes for a plurality of entities, wherein the isolated memory and processing resources of the server are exclusively reserved for processes associated with the first entity, and wherein the memory and processing resources are isolated from other memory and processing resources of the server that are used for executing the multiple processes for the plurality of entities.

13. The system of claim 11 , the operations further comprising executing, by the virtual machine, one or more serverless functions.

14. The system of claim 13 , wherein the one or more serverless functions comprise Lambda functions.

15. The system of claim 11 , wherein the virtual machine runs a host operating system comprising the guest operating system, and wherein the host operating system runs an executable functional code block comprising the one or more cryptographic processes.

16. The system of claim 15 , the operations further comprising:

establishing, by a client device, a communication session with the publicly accessible server via a TCP interface; and

receiving, from the client device through the communication session, a message directed to the host operating system via a public-key cryptography standard (PKCS) #11 interface, the message comprising a request to encrypt or decrypt data using the cryptographic keys.

17. The system of claim 16 , wherein the message is received from the client device via the Internet.

18. The system of claim 16 , the operations further comprising:

generating, by the executable image file, one or more credentials in response to receiving the message; and

transmitting the one or more credentials to the client device via the PKCS #11 interface.

19. The system of claim 18 , wherein the client device is configured to obtain access to a secure resource protected by one or more physical or logical access devices based on the one or more credentials.

20. A non-transitory computer-readable medium comprising non-transitory computer-readable instructions that, when executed by one or more processors, configure the one or more processors to perform operations comprising:

generating, on a publicly accessible server, a secure enclave, the secure enclave having isolated memory and processing resources of the server;

installing, on the secure enclave, a virtual machine comprising a guest operating system of a first entity;

installing, by the virtual machine on the guest operating system, one or more cryptographic processes associated with the first entity; and

encrypting and decrypting cryptographic keys associated with the first entity using the one or more cryptographic processes.